Loading npm security reports…

@weppy/roblox-mcp@2.14.4: Malicious npm security report (Block) | LPM Firewall

registry / @weppy/roblox-mcp / 2.14.4

@weppy/roblox-mcp@2.14.4

MCP (Model Context Protocol) server for Roblox Studio integration - enables AI coding agents to interact with Roblox Studio in real-time

AI Security Review

scanned 11d ago · by lpm-firewall-ai

The active MCP server performs default telemetry collection. It fetches the user's public IP, combines it with a persistent device-derived identifier and usage events, and transmits the result externally.

Static reason

One or more suspicious static signals were detected.

Trigger

Starting the dist/index.js MCP server.

Impact

User and device activity can be tracked externally without an affirmative runtime opt-in.

Mechanism

Startup initializes telemetry; telemetry fetches the public IP and posts queued event payloads containing identifiers and the IP to external analytics infrastructure.

Attack narrative

When the MCP server starts, its bundled analytics manager is initialized with telemetry enabled by default. It generates or reuses a persistent device identifier, obtains the public IP address from an external service, and attaches the IP and device-derived identifier to telemetry payloads sent to Google Analytics. The bundle also contains a package-operated device-observation endpoint. This collection is unrelated to the manifest's stated Roblox Studio integration purpose and runs automatically during ordinary server use.

AI rationale

The active entrypoint automatically collects and exports a persistent identifier, public IP address, and usage telemetry to third parties. This is a concrete data-exfiltration surface rather than an inert capability.

Evidence

dist/index.js

Network endpoints3

api.ipify.orgwww.google-analytics.com/mp/collectweppy-operations-server.hope841026.workers.dev/public/mcp/device-observation/v1

Source & flagged code

8 flagged · loading source

dist/index.jsView file

104\r L105: `+n)}function yc(t,e,n,r,i,a){if(t.listenerCount("wsClientError")){let o=new Error(i);Error.captureStackTrace(o,yc),t.emit("wsClientError",o,n,e)}else Sg(n,r,i,a)}});import y7 from... L106: `)){if(/^\s*#/.test(e))continue;let n=/^\s*root\s*=\s*(?<mountPoint>"[^"]*"|'[^']*'|[^#]*)/.exec(e);if(n)return n.groups.mountPoint.trim().replaceAll(/^["']|["']$/g,"")}}var w7=Y((...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L104

104\r L105: `+n)}function yc(t,e,n,r,i,a){if(t.listenerCount("wsClientError")){let o=new Error(i);Error.captureStackTrace(o,yc),t.emit("wsClientError",o,n,e)}else Sg(n,r,i,a)}});import y7 from... L106: `)){if(/^\s*#/.test(e))continue;let n=/^\s*root\s*=\s*(?<mountPoint>"[^"]*"|'[^']*'|[^#]*)/.exec(e);if(n)return n.groups.mountPoint.trim().replaceAll(/^["']|["']$/g,"")}}var w7=Y((...

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L104

6|| (${o} === "string" && ${i} && ${i} == +${i} && !(${i} % 1))`).assign(s,(0,re._)`+${i}`);return;case"boolean":r.elseIf((0,re._)`${i} === "false" || ${i} === 0 || ${i} === null`).... L7: || ${o} === "boolean" || ${i} === null`).assign(s,(0,re._)`[${i}]`)}}}function lte({gen:t,parentData:e,parentDataProperty:n},r){t.if((0,re._)`${e} !== undefined`,()=>t.assign((0,re... L8: missingProperty: ${r}, ... L10: deps: ${n}}`};var Eie={keyword:"dependencies",type:"object",schemaType:"object",error:vi.error,code(t){let[e,n]=Tie(t);g4(t,e),h4(t,n)}};function Tie({schema:t}){let e={},n={};for(... L11: at `+t[n].toString();return e}function coe(t){if(!t)throw new TypeError("argument namespace is required");var e=Gb(),n=zl(e[1]),r=n[0];function i(a){Zb.call(i,a)}return i._file=r,i... L12: `,"utf8")}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L6

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: `}Yq.exports=Xde;function Xde(t,e,n){var r=n||{},i=r.env||process.env.NODE_ENV||"development",a=r.onerror;return function(o){var s,c,l;if(!o&&Gq(e)){sT("cannot 404 after headers se... `;t.dashboardSseClients?.forEach(i=>{i.write(r)})}var ca=Y(()=>{"use strict"});import _o from"path";import{randomUUID as Xge}from"crypto";import{promises as Ls,renameSync as Qge}fr... ${" ".repeat(e)}}`}throw new TypeError(`Unsupported canonical JSON value: ${typeof t}`)}var om=Y(()=>{"use strict"});import{randomUUID as She}from"crypto";import qs from"path";imp... `:""}function k5(t){return Buffer.byteLength(t,"utf8")}function mA(t){return

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

3var bK=Object.create;var Gw=Object.defineProperty;var _K=Object.getOwnPropertyDescriptor;var xK=Object.getOwnPropertyNames;var SK=Object.getPrototypeOf,wK=Object.prototype.hasOwnPr... L4: `:""},this._extScope=e,this._scope=new zr.Scope({parent:e}),this._nodes=[new AP]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu... L5: || (${o} == "string" && ${i} && ${i} == +${i})`).assign(s,(0,re._)`+${i}`);return;case"integer":r.elseIf((0,re._)`${o} === "boolean" || ${i} === null L6: || (${o} === "string" && ${i} && ${i} == +${i} && !(${i} % 1))`).assign(s,(0,re._)`+${i}`);return;case"boolean":r.elseIf((0,re._)`${i} === "false" || ${i} === 0 || ${i} === null`).... L7: || ${o} === "boolean" || ${i} === null`).assign(s,(0,re._)`[${i}]`)}}}function

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L3

3Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js L3: var bK=Object.create;var Gw=Object.defineProperty;var _K=Object.getOwnPropertyDescriptor;var xK=Object.getOwnPropertyNames;var SK=Object.getPrototypeOf,wK=Object.prototype.hasOwnPr... L4: `:""},this._extScope=e,this._scope=new zr.Scope({parent:e}),this._nodes=[new AP]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu... L5: || (${o} == "string" && ${i} && ${i} == +${i})`).assign(s,(0,re._)`+${i}`);return;case"integer":r.elseIf((0,re._)`${o} === "boolean" || ${i} === null L6: || (${o} === "string" && ${i} && ${i} == +${i} && !(${i} % 1))`).assign(s,(0,re._)`+${i}`);return;case"boolean":r.elseIf((0,re._)`${i} === "false" || ${i} === 0 || ${i} === null`)...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L3

6|| (${o} === "string" && ${i} && ${i} == +${i} && !(${i} % 1))`).assign(s,(0,re._)`+${i}`);return;case"boolean":r.elseIf((0,re._)`${i} === "false" || ${i} === 0 || ${i} === null`).... L7: || ${o} === "boolean" || ${i} === null`).assign(s,(0,re._)`[${i}]`)}}}function lte({gen:t,parentData:e,parentDataProperty:n},r){t.if((0,re._)`${e} !== undefined`,()=>t.assign((0,re... L8: missingProperty: ${r},

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L6

3var bK=Object.create;var Gw=Object.defineProperty;var _K=Object.getOwnPropertyDescriptor;var xK=Object.getOwnPropertyNames;var SK=Object.getPrototypeOf,wK=Object.prototype.hasOwnPr... L4: `:""},this._extScope=e,this._scope=new zr.Scope({parent:e}),this._nodes=[new AP]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu... L5: || (${o} == "string" && ${i} && ${i} == +${i})`).assign(s,(0,re._)`+${i}`);return;case"integer":r.elseIf((0,re._)`${o} === "boolean" || ${i} === null L6: || (${o} === "string" && ${i} && ${i} == +${i} && !(${i} % 1))`).assign(s,(0,re._)`+${i}`);return;case"boolean":r.elseIf((0,re._)`${i} === "false" || ${i} === 0 || ${i} === null`).... L7: || ${o} === "boolean" || ${i} === null`).assign(s,(0,re._)`[${i}]`)}}}function

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L3

Source & flagged code

8 flagged

dist/index.jsView file

104\r L105: `+n)}function yc(t,e,n,r,i,a){if(t.listenerCount("wsClientError")){let o=new Error(i);Error.captureStackTrace(o,yc),t.emit("wsClientError",o,n,e)}else Sg(n,r,i,a)}});import y7 from... L106: `)){if(/^\s*#/.test(e))continue;let n=/^\s*root\s*=\s*(?<mountPoint>"[^"]*"|'[^']*'|[^#]*)/.exec(e);if(n)return n.groups.mountPoint.trim().replaceAll(/^["']|["']$/g,"")}}var w7=Y((...

High

Child Process

Package source references child process execution.

dist/index.jsView on unpkg · L104

104\r L105: `+n)}function yc(t,e,n,r,i,a){if(t.listenerCount("wsClientError")){let o=new Error(i);Error.captureStackTrace(o,yc),t.emit("wsClientError",o,n,e)}else Sg(n,r,i,a)}});import y7 from... L106: `)){if(/^\s*#/.test(e))continue;let n=/^\s*root\s*=\s*(?<mountPoint>"[^"]*"|'[^']*'|[^#]*)/.exec(e);if(n)return n.groups.mountPoint.trim().replaceAll(/^["']|["']$/g,"")}}var w7=Y((...

High

Shell

Package source references shell execution.

dist/index.jsView on unpkg · L104

6|| (${o} === "string" && ${i} && ${i} == +${i} && !(${i} % 1))`).assign(s,(0,re._)`+${i}`);return;case"boolean":r.elseIf((0,re._)`${i} === "false" || ${i} === 0 || ${i} === null`).... L7: || ${o} === "boolean" || ${i} === null`).assign(s,(0,re._)`[${i}]`)}}}function lte({gen:t,parentData:e,parentDataProperty:n},r){t.if((0,re._)`${e} !== undefined`,()=>t.assign((0,re... L8: missingProperty: ${r}, ... L10: deps: ${n}}`};var Eie={keyword:"dependencies",type:"object",schemaType:"object",error:vi.error,code(t){let[e,n]=Tie(t);g4(t,e),h4(t,n)}};function Tie({schema:t}){let e={},n={};for(... L11: at `+t[n].toString();return e}function coe(t){if(!t)throw new TypeError("argument namespace is required");var e=Gb(),n=zl(e[1]),r=n[0];function i(a){Zb.call(i,a)}return i._file=r,i... L12: `,"utf8")}

High

Same File Env Network Execution

A single source file combines environment access, network access, and code or shell execution; review context before blocking.

dist/index.jsView on unpkg · L6

•Manifest-reachable source captures an API credential, sends it to a fixed unofficial gateway, and persists that redirection in agent or shell configuration. dist/index.js: `}Yq.exports=Xde;function Xde(t,e,n){var r=n||{},i=r.env||process.env.NODE_ENV||"development",a=r.onerror;return function(o){var s,c,l;if(!o&&Gq(e)){sT("cannot 404 after headers se... `;t.dashboardSseClients?.forEach(i=>{i.write(r)})}var ca=Y(()=>{"use strict"});import _o from"path";import{randomUUID as Xge}from"crypto";import{promises as Ls,renameSync as Qge}fr... ${" ".repeat(e)}}`}throw new TypeError(`Unsupported canonical JSON value: ${typeof t}`)}var om=Y(()=>{"use strict"});import{randomUUID as She}from"crypto";import qs from"path";imp... `:""}function k5(t){return Buffer.byteLength(t,"utf8")}function mA(t){return

High

Credential Redirect Persistence

Manifest-reachable source sends a prompted API credential to a fixed unofficial gateway and persists the redirection.

dist/index.jsView on unpkg

3var bK=Object.create;var Gw=Object.defineProperty;var _K=Object.getOwnPropertyDescriptor;var xK=Object.getOwnPropertyNames;var SK=Object.getPrototypeOf,wK=Object.prototype.hasOwnPr... L4: `:""},this._extScope=e,this._scope=new zr.Scope({parent:e}),this._nodes=[new AP]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu... L5: || (${o} == "string" && ${i} && ${i} == +${i})`).assign(s,(0,re._)`+${i}`);return;case"integer":r.elseIf((0,re._)`${o} === "boolean" || ${i} === null L6: || (${o} === "string" && ${i} && ${i} == +${i} && !(${i} % 1))`).assign(s,(0,re._)`+${i}`);return;case"boolean":r.elseIf((0,re._)`${i} === "false" || ${i} === 0 || ${i} === null`).... L7: || ${o} === "boolean" || ${i} === null`).assign(s,(0,re._)`[${i}]`)}}}function

High

Command Output Exfiltration

Source combines command execution, command-output handling, and outbound requests; review data flow before blocking.

dist/index.jsView on unpkg · L3

3Trigger-reachable command-output exfiltration chain: scripts.start -> dist/index.js L3: var bK=Object.create;var Gw=Object.defineProperty;var _K=Object.getOwnPropertyDescriptor;var xK=Object.getOwnPropertyNames;var SK=Object.getPrototypeOf,wK=Object.prototype.hasOwnPr... L4: `:""},this._extScope=e,this._scope=new zr.Scope({parent:e}),this._nodes=[new AP]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu... L5: || (${o} == "string" && ${i} && ${i} == +${i})`).assign(s,(0,re._)`+${i}`);return;case"integer":r.elseIf((0,re._)`${o} === "boolean" || ${i} === null L6: || (${o} === "string" && ${i} && ${i} == +${i} && !(${i} % 1))`).assign(s,(0,re._)`+${i}`);return;case"boolean":r.elseIf((0,re._)`${i} === "false" || ${i} === 0 || ${i} === null`)...

High

Trigger Reachable Command Output Exfiltration

A manifest entrypoint or package-local install chain reaches command-output exfiltration behavior.

dist/index.jsView on unpkg · L3

6|| (${o} === "string" && ${i} && ${i} == +${i} && !(${i} % 1))`).assign(s,(0,re._)`+${i}`);return;case"boolean":r.elseIf((0,re._)`${i} === "false" || ${i} === 0 || ${i} === null`).... L7: || ${o} === "boolean" || ${i} === null`).assign(s,(0,re._)`[${i}]`)}}}function lte({gen:t,parentData:e,parentDataProperty:n},r){t.if((0,re._)`${e} !== undefined`,()=>t.assign((0,re... L8: missingProperty: ${r},

Low

Eval

Package source references a known benign dynamic code generation pattern.

dist/index.jsView on unpkg · L6

3var bK=Object.create;var Gw=Object.defineProperty;var _K=Object.getOwnPropertyDescriptor;var xK=Object.getOwnPropertyNames;var SK=Object.getPrototypeOf,wK=Object.prototype.hasOwnPr... L4: `:""},this._extScope=e,this._scope=new zr.Scope({parent:e}),this._nodes=[new AP]}toString(){return this._root.render(this.opts)}name(e){return this._scope.name(e)}scopeName(e){retu... L5: || (${o} == "string" && ${i} && ${i} == +${i})`).assign(s,(0,re._)`+${i}`);return;case"integer":r.elseIf((0,re._)`${o} === "boolean" || ${i} === null L6: || (${o} === "string" && ${i} && ${i} == +${i} && !(${i} % 1))`).assign(s,(0,re._)`+${i}`);return;case"boolean":r.elseIf((0,re._)`${i} === "false" || ${i} === 0 || ${i} === null`).... L7: || ${o} === "boolean" || ${i} === null`).assign(s,(0,re._)`[${i}]`)}}}function

Low

Weak Crypto

Package source references weak cryptographic algorithms.

dist/index.jsView on unpkg · L3